From 2b2b61956044eafac0133b6f254d35ce975d07c8 Mon Sep 17 00:00:00 2001 From: David Gustafsson Date: Tue, 3 Mar 2020 14:32:31 +0100 Subject: [PATCH] Bug 24788: Remove autoloaded column accessors in Koha::Object->store Content-Type: text/plain; charset=utf-8 Columns are accessed as methods, relying on AUTOLOAD, in Koha::Object->store. This has security implications and could also be a source of strange bugs. To test: 1) Apply patches for Bug 14957 2) Follow the testing instructions, when saving a new marc rule and error is thrown. 3) Apply patch 4) Try saving a new rule once again, this should now work Signed-off-by: David Nind Signed-off-by: Marcel de Rooy --- Koha/Object.pm | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/Koha/Object.pm b/Koha/Object.pm index dae52ac389..11074498ba 100644 --- a/Koha/Object.pm +++ b/Koha/Object.pm @@ -129,24 +129,26 @@ sub store { # Integers if ( _numeric_column_type( $columns_info->{$col}->{data_type} ) ) { # Has been passed but not a number, usually an empty string - if ( defined $self->$col and not looks_like_number( $self->$col ) ) { + my $value = $self->_result()->get_column($col); + if ( defined $value and not looks_like_number( $value ) ) { if ( $columns_info->{$col}->{is_nullable} ) { # If nullable, default to null - $self->$col(undef); + $self->_result()->set_column($col => undef); } else { # If cannot be null, get the default value # What if cannot be null and does not have a default value? Possible? - $self->$col($columns_info->{$col}->{default_value}); + $self->_result()->set_column($col => $columns_info->{$col}->{default_value}); } } } elsif ( _date_or_datetime_column_type( $columns_info->{$col}->{data_type} ) ) { # Set to null if an empty string (or == 0 but should not happen) - if ( defined $self->$col and not $self->$col ) { + my $value = $self->_result()->get_column($col); + if ( defined $value and not $value ) { if ( $columns_info->{$col}->{is_nullable} ) { - $self->$col(undef); + $self->_result()->set_column($col => undef); } else { - $self->$col($columns_info->{$col}->{default_value}); + $self->_result()->set_column($col => $columns_info->{$col}->{default_value}); } } } -- 2.11.0